Remote assistance for managed mobile devices

• US 9,563,445 B2
• Filed: 05/04/2015
• Issued: 02/07/2017
• Est. Priority Date: 05/05/2014
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Desai, Nitin, Singh, Jaspreet
• Primary Examiner(s): Rahim, Monjour
• Application Number:
  US14/702,954
• Publication Number:
  US 20150319178A1
• Time in Patent Office: 645 Days
• Field of Search: 726/1
• US Class Current: 1/1
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: G06F 9/452 Remote windowing, e.g. X-Window System, desktop virtualisation protocols for virtual reality H04L67/131
• CPC Class Codes: G06F 9/453 Help systems
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

According to some aspects disclosed herein, a system for remote assistance and control of user devices subject to one or more remote assistance policies may be provided. In some embodiments, an administrator may request remote control of a managed user device. A managed application launcher may be provided by the user device and may be modified by the user device to remove managed applications or otherwise prevent access to applications that have a policy indicating that remote assistance is not allowed. The administrator may open a managed application included in the launcher and remotely control that application. In other embodiments, a user of the managed user device may initiate a request for remote assistance from within a managed application and/or the managed application launcher. The administrator'"'"'s control of the user device and access to other applications on the user device may be limited based on the remote assistance policies.

Claims

1. A method comprising:

initiating, by a managed mobile device comprising at least one processor, a network interface, and a memory storing a remote assistance policy set comprising one or more remote assistance policies, a remote assistance connection with a remote support server via the network interface;

receiving, by the managed mobile device, via the remote assistance connection initiated with the remote support server, remote assistance input provided by a user of an administrator console device, the remote assistance input being received by the remote support server via an interface provided by the remote support server to the administrator console device;

processing, by the managed mobile device, the remote assistance input based on the remote assistance policy set, wherein processing the remote assistance input based on the remote assistance policy set comprises;

enforcing a first access policy of the remote assistance policy set that allows the user of the administrator console device to control one or more managed applications on the managed mobile device to which one or more enterprise policies are applied; and

enforcing a second access policy of the remote assistance policy set that prevents the user of the administrator console device from controlling one or more unmanaged applications on the managed mobile device to which the one or more enterprise policies are not applied; and

sending, by the managed mobile device, to the remote support server, one or more user interface updates based on processing the remote assistance input based on the remote assistance policy set.

2. The method of claim 1, wherein initiating the remote assistance connection with the remote support server comprises:

receiving a request for remote control from the remote support server;

determining, based on the remote assistance policy set, whether to grant the request for remote control; and

establishing the remote assistance connection with the remote support server based on determining to grant the request for remote control.

3. The method of claim 1, wherein initiating the remote assistance connection with the remote support server comprises:

receiving a request for remote assistance from a local user of the managed mobile device;

sending a message requesting remote assistance to one or more of the remote support server or the administrator console device; and

establishing the remote assistance connection with the remote support server.

4. The method of claim 1, wherein processing the remote assistance input based on the remote assistance policy set comprises:

determining whether the remote assistance input is allowed based on an input policy of the remote assistance policy set; and

providing the remote assistance input to an application on the managed mobile device when it is determined that the remote assistance input is allowed.

5. The method of claim 1, wherein processing the remote assistance input based on the remote assistance policy set comprises enforcing a first input policy of the remote assistance policy set that limits actions that are performable by the user of the administrator console device.

6. The method of claim 1, wherein processing the remote assistance input based on the remote assistance policy set comprises enforcing a second input policy of the remote assistance policy set that limits portions of a user interface that are operable by the user of the administrator console device.

7. The method of claim 1, wherein sending the one or more user interface updates comprises sending at least one user interface update based on a first screen content policy of the remote assistance policy set that obscures portions of a user interface generated by the managed mobile device.

8. The method of claim 1, wherein sending the one or more user interface updates comprises sending at least one user interface update based on a second screen content policy of the remote assistance policy set that obscures content matching one or more criteria.

9. The method of claim 1, comprising:

receiving, by the managed mobile device, via the remote assistance connection initiated with the remote support server, from the user of the administrator console device, a request to override at least one policy of the remote assistance policy set;

determining whether to approve the request to override the at least one policy of the remote assistance policy set; and

based on determining to approve the request to override the at least one policy of the remote assistance policy set, bypassing, by the managed mobile device, the at least one policy of the remote assistance policy set during processing the remote assistance input based on the remote assistance policy set and sending the one or more user interface updates to the remote support server.

10. The method of claim 9, wherein determining whether to approve the request to override the at least one policy of the remote assistance policy set comprises determining whether the user of the administrator console device is authorized to override the at least one policy of the remote assistance policy set.

11. The method of claim 9, wherein determining whether to approve the request to override the at least one policy of the remote assistance policy set comprises prompting a local user of the managed mobile device to approve the request to override the at least one policy of the remote assistance policy set.

12. The method of claim 1, wherein the interface provided by the remote support server to the administrator console device comprises a web-based user interface.

13. The method of claim 1, comprising:

prior to initiating the remote assistance connection with the remote support server;

determining, by the managed mobile device, based on the remote assistance policy set, whether to establish the remote assistance connection with the remote support server; and

based on determining to establish the remote assistance connection with the remote support server, establishing, by the managed mobile device, the remote assistance connection with the remote support server via the network interface.

14. The method of claim 1, wherein the remote assistance policy set comprises at least one policy having a scope applying to an individual device and at least one policy having a scope applying to a group of devices.

15. The method of claim 1, wherein the remote assistance policy set comprises at least one user-defined policy configured by a local user of the managed mobile device and at least one managed policy associated with a managed application framework.

16. The method of claim 1, comprising:

prior to initiating the remote assistance connection with the remote support server;

providing, by the managed mobile device, a list of applications to the remote support server based on the remote assistance policy set; and

establishing, by the managed mobile device, the remote assistance connection with the remote support server via the network interface, wherein the remote assistance connection provides access to an application selected from the list of applications.

17. One or more non-transitory computer readable media storing instructions that, when executed, cause a managed mobile device comprising at least one processor, a network interface, and a memory storing a remote assistance policy set comprising one or more remote assistance policies, to:

initiate a remote assistance connection with a remote support server via the network interface;

receive, via the remote assistance connection initiated with the remote support server, remote assistance input provided by a user of an administrator console device, the remote assistance input being received by the remote support server via an interface provided by the remote support server to the administrator console device;

process the remote assistance input based on the remote assistance policy set, wherein processing the remote assistance input based on the remote assistance policy set comprises;

enforcing a first access policy of the remote assistance policy set that allows the user of the administrator console device to control one or more managed applications on the managed mobile device to which one or more enterprise policies are applied; and

enforcing a second access policy of the remote assistance policy set that prevents the user of the administrator console device from controlling one or more unmanaged applications on the managed mobile device to which the one or more enterprise policies are not applied; and

send, to the remote support server, one or more user interface updates based on processing the remote assistance input based on the remote assistance policy set.

18. The one or more non-transitory computer readable media of claim 17, wherein initiating the remote assistance connection with the remote support server comprises:

receiving a request for remote control from the remote support server;

determining, based on the remote assistance policy set, whether to grant the request for remote control; and

establishing the remote assistance connection with the remote support server based on determining to grant the request for remote control.

19. The one or more non-transitory computer readable media of claim 17, wherein initiating the remote assistance connection with the remote support server comprises:

receiving a request for remote assistance from a local user of the managed mobile device;

sending a message requesting remote assistance to one or more of the remote support server or the administrator console device; and

establishing the remote assistance connection with the remote support server.

20. A managed mobile device comprising:

at least one hardware processor;

a network interface;

and a memory storing a remote assistance policy set comprising one or more remote assistance policies and instructions that, when executed, cause the managed mobile device to;

initiate a remote assistance connection with a remote support server via the network interface;

receive, via the remote assistance connection initiated with the remote support server, remote assistance input provided by a user of an administrator console device, the remote assistance input being received by the remote support server via an interface provided by the remote support server to the administrator console device;

process the remote assistance input based on the remote assistance policy set, wherein processing the remote assistance input based on the remote assistance policy set comprises;

enforcing a first access policy of the remote assistance policy set that allows the user of the administrator console device to control one or more managed applications on the managed mobile device to which one or more enterprise policies are applied;

and enforcing a second access policy of the remote assistance policy set that prevents the user of the administrator console device from controlling one or more unmanaged applications on the managed mobile device to which the one or more enterprise policies are not applied; and

send, to the remote support server, one or more user interface updates based on processing the remote assistance input based on the remote assistance policy set.